guardrail: upgrader never modifies cc-ci tests/harness unless --with-tests

Absolute, mode-gated rule reinforced in /recipe-upgrade (Guardrails + the new
step-2b direct-deploy loop where the upgrader has cc-ci host access) and noted as
the interim safeguard in IDEAS.md until the deploy loop moves to isolated infra.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cc-ci-plan/IDEAS.md

@@ -157,5 +157,10 @@ item into the project `BACKLOG.md` as `[idea]` if/when it becomes relevant.
     deploy path may assume `--server default`/local, so the per-run CI deploys vs the upgrader's
     test-server deploys need a clear split. Until then, the local-swarm dev loop + the orphan-sweep are
     the interim posture (functional, but NOT isolation-safe against a malicious/compromised upgrader).
+  - *Interim safeguard (in force now, until this lands):* the upgrader **must NEVER modify the cc-ci
+    tests or harness (`tests/**`, `runner/**`) unless explicitly invoked with `--with-tests`** — encoded
+    as an absolute guardrail in `/recipe-upgrade` (and its step-2b direct-deploy loop). It is a written
+    rule, not an enforced boundary — which is exactly why the separate-infra isolation above is the real
+    fix.
   - *When to revisit:* before running the upgrader fully unattended/untrusted at scale, or alongside the
     "package cc-ci as a recipe" spike above (both hinge on a separate disposable test Swarm). *Added:* 2026-06-09.